Privacy Policy

1. Controller identity and contact

Sapphire Property Investments & Ventures is the public brand led by Sabreena. Existing storefront copy names Sapphire Property Investments and Ventures Ltd; this has not been verified as the legal controller of this app. The controller’s legal identity, registered or service address and company details must be confirmed before launch.

talk@sapphireproperties.app is the owner-selected public contact for enquiries, including privacy requests. Its Microsoft 365 mailbox is being set up separately; existence, receipt and delivery have not been verified. It is not a confirmed DPO address. No DPO appointment or ICO registration number is claimed. The Contact page offers an email draft only; do not rely on delivery until setup is confirmed. Do not include tenant documents, passwords or identity documents in the initial enquiry.

2. Preview data and future account data

The operational landlord/tenant workspaces use fictional records. Property, repair, inspection, compliance, income and invoice edits stay in browser memory. Files selected for demo evidence and microphone recordings stay as temporary object URLs; refreshing ends that demo state. Do not enter real tenant information or upload real tenancy records into this preview.

Tab storage remembers onboarding preferences, tour progress, notification read state and review cooldowns. Feedback text and ratings are in memory, not submitted to a support service. The announcement checkbox is an unsaved local preference. Editorial sign-in uses Lovable Cloud authentication; persisted authentication tokens can be held in browser storage. Private editorial tables exist separately from demo property data. The latest audit found no users or editorial records; this is a point-in-time finding, not a promise that the service never processes personal data.

Requests to host the site, fonts, map tiles, contact pages and authentication can disclose IP address, browser/request details and relevant credentials to the receiving service. Error reporting hooks may receive error messages, stack traces and page paths when available. We have not verified platform log contents or retention. Future real accounts may require identity/contact details, property memberships, repair/inspection records, private documents and security audit information; those flows are not yet enabled.

3. Purposes and lawful bases — owner review required

A launch processing register must match each personal-data purpose to a lawful basis under UK GDPR and the Data Protection Act 2018, as amended. Candidate bases include contract for requested account services, legal obligation where a specific law requires processing, and assessed legitimate interests for proportionate security and service operation. These are proposed mappings, not completed legal assessments; the relevant obligation and balancing assessment must be documented.

Optional product announcements require a distinct, freely chosen opt-in where required by UK GDPR/PECR, with withdrawal. Reading a privacy notice is not consent to marketing, and essential account/security notices must not depend on marketing consent. Sensitive data, criminal-offence information and unnecessary identity documents should not be collected without a reviewed purpose and additional conditions.

4. Recipients, services and transfers

Observed services are Lovable/Lovable Cloud for this app and authentication, Google Fonts for remote font files, and OpenStreetMap tile servers on the portfolio map. The Contact page now prepares an email draft for your own email app; direct sending is unconfigured. Details are validated through a server action but are not stored or emailed by the app. Legacy buyer pages may open Shopify; those external pages have separate processing. Google/Lovable sign-in options are present in editorial source, but provider configuration has not been confirmed. YouTube and other social destinations are links, not embedded players in the homepage feature.

These observations are not an approved subprocessor list or executed contract. The legal entities, service roles, onward providers, hosting geography, international access and transfer mechanisms must be verified. Do not assume UK-only hosting. Where restricted transfers apply, suitable safeguards such as an applicable UK adequacy decision, IDTA or UK Addendum and transfer assessment must be selected and documented before real data use. Stripe payments are not implemented; no billing processor is claimed active.

5. Retention and deletion

Operational demo state disappears on refresh; tab preferences last in the tab session unless cleared. Authentication persistence is separate and may survive refresh until sign-out or storage removal. Browser downloads or print-to-PDF copies remain on your device until you remove them. Local demo reset does not erase server-side records or platform logs.

No verified server, contact, security-log or backup retention periods are available. Before launch the owner must approve purpose-specific periods, deletion schedules, legal holds and backup expiry with providers. We do not invent a fixed duration or promise instantaneous deletion. Account Deletion explains the manual-only path and safeguards for shared records.

6. Your rights and complaints

Depending on the circumstances, you may request access, correction, erasure, restriction, portability and object to processing; consent may be withdrawn without affecting prior lawful processing. Rights are not absolute: another person’s rights or a legal retention duty can affect the outcome. There is no automated eligibility, credit or legal decision-making service in this demo.

Use Account & Data Rights for the manual route. A rights response is generally due within one month under the applicable rules; complex or multiple requests may permit a further two months with explanation. Identity checks, clarification and any applicable statutory timing rules must be handled proportionately. This is not a configured response-service guarantee. You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/; you need not waive that right to contact us first.

7. Cookies, children and changes

See Cookie Policy for browser storage and external services. No app-controlled advertising or optional marketing tracker was found; platform behaviour needs confirmation before launch. This landlord/tenant service is not designed for children. The owner must confirm account-age policy and how households with children are protected; do not upload unnecessary children’s information. No age-verification control is claimed.

This version is a transparent preview draft, not a finalized live notice or guarantee of UK GDPR compliance. Material changes, final controller facts and new data flows must be reviewed and communicated before launch.